Aha Orch Xx

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.1.0

Overview

This is a markdown-only orchestration skill that is coherent with its stated purpose and includes safety boundaries, though its upgrade guidance should be handled carefully.

Before installing or upgrading, prefer reviewing the repository state and using a pinned or verified version instead of blindly running the latest `npx` command. Expect this skill to influence how your agent delegates and reports work; it should not bypass approvals, share secrets, or create persistent workers without explicit confirmation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned npx Package Execution in the Upgrade Procedure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 40
Vulnerability Type: Insecure, mutable third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

markdown

- **Upgrade**: Run `git pull` in the aha-orch repo, or re-run `npx skills add its-how/aha-orch` to get the latest version.

Technical Analysis

The documented upgrade procedure invokes the skills npm package through npx without specifying a reviewed package version. It also identifies the Skill source by repository name rather than an immutable commit or signed release.

When the command is followed, npx may download and execute the package version currently resolved by the npm registry. The installed Skill content is likewise obtained from mutable upstream state. Consequently, the effective code and instructions used during a future upgrade can differ from the artifact covered by this audit.

This creates a supply-chain exposure: compromise of the npm package, its publisher account, the package-resolution path, or the upstream repository could introduce malicious installer behavior or altered Skill content.

Attack Path

1. An attacker compromises the skills npm package, its publishing account, or the referenced upstream repository.
2. The attacker publishes a malicious package version or modifies the repository's mutable default branch.
3. A user follows the documented upgrade instruction and runs npx skills add its-how/aha-orch.
4. npx resolves and executes the mutable package without an explicit reviewed version or integrity constraint.
5. Malicious installer code may execute with the invoking user's privileges, or malicious Skill instructions may be installed and subsequently loaded by an agent.

Impact Assessment

Successful exploitation could allow arbitrary actions within the privileges and environment available to the invoking user and the installer process. Depending on those privileges, possible effects include reading or m ...[truncated 459 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI package to a reviewed version, for example by using an explicit version rather than an unqualified npx skills.
• Pin the Skill source to an immutable commit hash or verified release tag instead of relying on the latest default-branch state.
• Use npm lockfiles, integrity hashes, signed release artifacts, or equivalent provenance verification where supported.
• Prefer a locally installed and previously verified installer over automatic download and execution during each upgrade.
• Review release notes and source changes before upgrading.
• Run installation with the minimum required privileges in a sandboxed or otherwise restricted environment.
• Document the exact verified package version and source revision so users can reproduce the audited installation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run npx skills add its-how/aha-orch without pinning a specific package version. Because npx resolves and executes the latest matching package at runtime, a compromised upstream package, typosquatted dependency, or unexpected version change could result in execution of unreviewed code on the user's system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file mandates a fixed verbosity:low response style with hard limits on disclosure length, regardless of user needs or risk context. In a security-sensitive orchestration skill, this can suppress important safety caveats, reduce auditability, and make it easier for the agent to omit material details about capability use, permissions, or confirmation triggers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.